What you’re saying is true; however, you must consider 2 other scenarios that you have overlooked.

1. What if the employee finds a way around the employer’s technical enforcement and still accesses prohibited sites without the employer finding out?

2. (more likely) What about the employee’s access during his free time outside of work? What if an employee has the bad habit of using the same password everywhere and signs up for some malicious application using the same password which he uses to access the corporate network?

Employees who are not technical can place your network in jeopardy not only when they’re at work but everywhere and at any time. In my opinion neglecting to educate employees because they’re only allowed to access the Internet for strict work related purposes is in itself a security risk.

Indeed a lot of people who aren’t security aware tend to use the same password everywhere. Sometimes because they don’t know better and something it’s because they’re afraid if they choose something new they’re going to forget it and so they use the same old password which they know well.

@ Elizabeth

That is certainly something to be expected. As I mentioned above when one chooses a password, especially when they don’t have an IT Background, they will think about something which they will not forget. This is generally related to what they love the most. It’s actually amazing that she mixed her pet’s name with her birth year as I bet most of the time you would simply get pet names without additional detail as the additional detail would make the password harder to remember. In any case excellent work in getting your co-worker to strengthen her password!

Her love for her dog was quite obvious, and would not let a day go by without telling us his name. It took us about three tries to crack the coder, but we made sure to tell her about it afterwards. I can’t imagine what would’ve happened if someone with more malicious intentions got a hold of that kind of information.

I think the same can be said about Twitter. With a lot of third party websites allowing a whole array of different services, a lot of Twitter users are jumping on the bandwagon, giving these sites unrestricted access to their accounts. And if these suspicious sites can retrieve your password information and link it to your other social networking profiles, you just willingly gave out full-access to your entire online identity by clicking “Accept.”

I found this quite apt seeing that it’s the top of the list. After doing a survey on the security practices of one of our client’s employees, we’ve discovered that 9 out of 10 of them use the same passwords for their work, their e-mail and their social networking sites. It’s identity theft waiting to happen, and though it was only one company we looked at, we wouldn’t be surprised if this was a trend in a lot of other corporations.

@Carmel

There are ways to ensure these security checks aren’t circumvented, obviously you can never be sure it will be 100% effective but it can get quite close. It always depends on your setup and what you want to allow and deny. Generally having one Internet gateway and controlling access through that works best. If you want maximum security you could use a white list approach allowing the firewall at the gateway to only allow access on port 80 and only to those sites you want to allow. Additionally another option is to monitor what people visit and when somebody circumvents the technology he can still be disciplined for breaking the policy. Employees need to learn that the block is there to enforce the policy and going around it does not make the action right, it makes things worse.

Is there a fool-proof way to deny access to specific sites?

Don’t install applications such as those that claim to make you find out who’s checking your profile as Facebook doesn’t support that feature and will not allow a 3rd party app to do so. It might just pose a risk to your system. Next thing you know, your account “posts” status updates that you did not create.

Facebook is becoming a hacker heaven. If you use such social sites, steps should be taken to ensure your system and even your identity is protected.

I also advise thinking carefully before adding your boss to your friends list. The net is full of stories about people who added their boss to their friends list, forgot, and got busted (and in some cases fired!) when they posted a status bashing their workplace!